fix go1.21 not a toolchain (#8044)

go_modules/Dockerfile

@@ -27,10 +27,10 @@ COPY --chown=dependabot:dependabot go_modules $DEPENDABOT_HOME/go_modules
 COPY --chown=dependabot:dependabot common $DEPENDABOT_HOME/common
 COPY --chown=dependabot:dependabot updater $DEPENDABOT_HOME/dependabot-updater
 
-# See https://tip.golang.org/doc/toolchain#select
-# By specifying go1.20.8, we use 1.20.8 for any go.mod with go directive <=1.20.
-# By specifying auto, it automatically downloads the correct version if the go.mod is > 1.20,
-# unless it's already downloaded, like Go 1.21.0 above.
-ENV GOTOOLCHAIN="go1.20.8+auto"
+# See https://go.dev/doc/toolchain#select
+# By specifying go1.20.8, we use 1.20.8 for any go.mod with go directive <= 1.20.
+# In the file_parser, GOTOOLCHAIN=local is set otherwise, which uses the latest version above.
+ENV GOTOOLCHAIN="go1.20.8"
 # This pre-installs go 1.20.8 so that each job doesn't have to do it.
 RUN go version
+ENV GO_LEGACY=$GOTOOLCHAIN

go_modules/lib/dependabot/go_modules/file_parser.rb

@@ -9,11 +9,14 @@
 require "dependabot/errors"
 require "dependabot/file_parsers"
 require "dependabot/file_parsers/base"
+require "dependabot/go_modules/version"
 
 module Dependabot
   module GoModules
     class FileParser < Dependabot::FileParsers::Base
       def parse
+        set_gotoolchain_env
+
         dependency_set = Dependabot::FileParsers::Base::DependencySet.new
 
         required_packages.each do |dep|
@@ -25,6 +28,19 @@ def parse
 
       private
 
+      # set GOTOOLCHAIN=local if go version >= 1.21
+      def set_gotoolchain_env
+        go_directive = go_mod.content.match(/^go\s(\d+\.\d+)/)&.captures&.first
+        return ENV["GOTOOLCHAIN"] = ENV.fetch("GO_LEGACY") unless go_directive
+
+        go_version = Dependabot::GoModules::Version.new(go_directive)
+        ENV["GOTOOLCHAIN"] = if go_version >= "1.21"
+                               "local"
+                             else
+                               ENV.fetch("GO_LEGACY")
+                             end
+      end
+
       def go_mod
         @go_mod ||= get_original_file("go.mod")
       end

go_modules/spec/dependabot/go_modules/file_parser_spec.rb

@@ -11,6 +11,11 @@
 RSpec.describe Dependabot::GoModules::FileParser do
   it_behaves_like "a dependency file parser"
 
+  after do
+    # Reset to the default go toolchain after each test
+    ENV["GOTOOLCHAIN"] = ENV.fetch("GO_LEGACY")
+  end
+
   let(:parser) { described_class.new(dependency_files: files, source: source, repo_contents_path: repo_contents_path) }
   let(:files) { [go_mod] }
   let(:go_mod) do
@@ -124,6 +129,16 @@
           end
         end
       end
+
+      context "with a go.mod that has go 1.21 but no toolchain" do
+        let(:go_mod_fixture_name) { "go_1_21_no_toolchain.mod" }
+
+        it "sets GOTOOLCHAIN=local" do
+          parser.parse
+
+          expect(ENV.fetch("GOTOOLCHAIN", nil)).to eq("local")
+        end
+      end
     end
 
     describe "indirect dependencies" do

go_modules/spec/fixtures/go_mods/go_1_21_no_toolchain.mod

@@ -0,0 +1,5 @@
+module go_1_21
+
+go 1.21
+
+require rsc.io/quote v1.5.2